CVE-2026-15142 is a privilege escalation vulnerability in the Real Estate Manager Pro plugin for WordPress affecting all versions up to 12.8.6. The vulnerability is due to improper privilege management (CWE-269) in the allow_attachment_actions() function, where a target user ID is incorrectly treated as a media attachment ID during capability checks. This flaw enables authenticated attackers with Subscriber-level or higher access to edit administrator accounts and escalate their privileges to Administrator if the targeted user ID corresponds to a media attachment ID.

Successful exploitation allows an authenticated user with Subscriber-level or higher privileges to escalate their access to Administrator level, potentially leading to full control over the WordPress site, including content modification, user management, and configuration changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, restrict user roles and permissions carefully and monitor for suspicious activity related to user privilege changes.